Testing spring security with Postman

You can achieve authentication/authorization in postman through various authorization types given in postman dropdown under Authorization tab.

Below is the step to use Basic Auth which by default spring security provides.

In spring security you can customize your credentials in application.properties file as given below.

spring.security.user.name=yer spring.security.user.password=galem

Using http.httpBasic worked for me.

http.httpBasic() .and() .authorizeRequests() .antMatchers("/api/home") .hasRole("ADMIN") .antMatchers("/api/product/*") .hasRole("ADMIN") .and() .formLogin(); 

For me the Postman Interceptor was not working,
So I did the following and now I can login to the server.

1. Select POST request from dropdown and type login URL in request URL section.
2. Select Body from tabs
3. Enter username and password keys and values as shown in picture.
4. And click send this will create a temp cookie in postman and be there for a session.
5. You can also do GET request for logout URL to logout from session. Or delete the cookie from Cookies below Send button.

When using basic auth on postman, you will set the credentials on the authorization tab. Click on Authorization, choose the type as Basic Auth, the credentials section will be displayed for you to key in the username and password.

http.httpBasic is working for Testing spring security with Postman.

For example, Added the override configure method from the configuration class MyConfiguration.java

@Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().antMatchers("/admin/**").hasRole("ADMIN") .antMatchers("/**").permitAll().anyRequest().authenticated() .and().formLogin().permitAll().and().logout().permitAll().and().httpBasic(); http.cors().disable().csrf().disable(); } 

Note: To access the POST, PUT, and DELETE request you need to disable the cors and csrf as per code above.

What worked for me is:

1. Create POST request to given security endpoint

2. Set j_username and j_password in the x-www-form-urlencoded tab:

3. Put headers as follows:

4. In the settings tab I disabled following redirects: In that way when you call the request you will be able to check what was the result, for instance check the Set-Cookie Headers.

After calling this request you should be able to see the Set-Cookie and Location headers like:

This cookie which was just set should be used for all next requests for given domain. In that way those will be authenticated.